Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys now support external providers

developer.apple.com

Post reply on HN
Print view View original

151–160 of 185 posts

Re: Passkeys now support external providers

#151

Post by 9dev »

labcomputer wrote: post #133
ckastner wrote: post #10

Of all the recent publications with regards to passkeys, FIDO2, WebAuthn, etc., finally there's one with a simple and concise summary of the benefits: > Strong credentials. Every passkey is strong. They’re never guessable, reused, or weak. > Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers. > Safe from phishing. Passkeys are intrinsically linked with the app…

> Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers That’s not quite true, though. What is true is that the server does not have a plaintext copy of your private keys. That’s a crucial difference. The server has an encrypted copy of your private key, which your with token decrypts with its private key. That is how a usb key can store an unlimited number of U2…

This is just plain wrong. The server only ever stores your public key, private keys are stored on the clients. Everything else would defeat the entire purpose.

Re: Passkeys now support external providers

#152

Post by danShumway »

miles wrote: post #4

There is only this blurb to go on at the moment: "Passkeys can now be synced using external providers..." so it's hard to say exactly what it will mean for user control and choice. Which external providers? Will users be able to access and store their own private keys in compatible apps of their choosing? If so, aren't we largely back to passwords?

> aren't we largely back to passwords?

Key based authentication is a huge security improvement over passwords (especially for reducing phishing risks) even without the device-bound restrictions.

I'm strongly opposed to hardware-bound keys as a mass standard for most users, but key based authentication is great. One big advantage is that during the login process, sites "prove" their identity to you.

This is a security improvement that you could previously only really get with browser extensions and password managers, and even there it wasn't great because those extensions didn't work consistently across all sites and often failed at autofill, so a website failing to pull up your password manager might not actually be interpreted as a red flag. And there are other advantages too around account security for service providers, etc... none of which require attestation or hardware-bound keys.

Re: Passkeys now support external providers

#153

Post by [deleted] »

TheNewsIsHere wrote: post #99
heavyset_go wrote: post #50

Earlier quoted context omitted.

FIDO2 allows for things like resident keys, which the Yubikey can only hold so many of. The Yubikey can act in HMAC challenge mode, though, but that's not the mode used on the web.

Most web based services don’t seem to be using the discoverable credentials either. So far only my Apple ID and Azure AD accounts are utilizing those.

[deleted]

Re: Passkeys now support external providers

#154

Post by 9dev »

jiggawatts wrote: post #37

My method for judging the quality of software: Read the latest release notes, negate every statement, and think to yourself: "They were fine with it being like this until now." Passkeys have been advertised as a superior replacement to passwords, but really fundamental issues remain unaddressed. I have one (1) Windows PC and one (1) iDevice. Can I get these to sync? Will both be able to log me in to a Google Account?…

Easy. Think of passkeys as per-device credentials. You can have (1) windows PC credential and (1) iDevice credential, and register both with Google and Azure.

Re: Passkeys now support external providers

#155

Post by chimpoftheages »

9dev wrote: post #151
labcomputer wrote: post #133

Earlier quoted context omitted.

> Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers That’s not quite true, though. What is true is that the server does not have a plaintext copy of your private keys. That’s a crucial difference. The server has an encrypted copy of your private key, which your with token decrypts with its private key. That is how a usb key can store an unlimited number of U2…

This is just plain wrong. The server only ever stores your public key, private keys are stored on the clients. Everything else would defeat the entire purpose.

No, it is technically correct for nondiscoverable mode. Naturally, there should be low value in breaking the opacity of the stored key as it should be a private key only used with the server that holds it. (But it would still mean many sites requesting that you replace any token found to have such a defect.)

Re: Passkeys now support external providers

#156

Post by danShumway »

jsmith99 wrote: post #2

Originally seen via https://reddit.com/r/Bitwarden/comments/141uxz1/iosipados_17... This is big news as vendor lock in and inability to use our own sync was one of the biggest issues bought up whenever Passkeys are discussed. Apple are now allowing external sync fabrics such as password managers.

I'm very eager to see what Bitwarden does here, they're the first big[0] name that's actually Open Source that's on board. It's hard to take passkeys seriously when the vast majority of implementations are completely proprietary.

Seeing what Bitwarden comes up with and seeing whether or not the process for self-hosted Bitwarden accounts is actually seamless and works on platforms like desktop Linux -- to me, that's going to be a really big test of whether passkeys can credibly be claimed to be actually cross-platform.

[0]: I do think there have been some smaller proof-of-concepts, but... there's a difference of scale here.

Re: Passkeys now support external providers

#157

Post by spuz »

izacus wrote: post #120
spuz wrote: post #93

One thing I don't understand about offering passkey login for your email is how you would go about recovering an account if you lost access to the device which holds your passkey? Google states: "When you create a passkey, you opt in to a passkey-first, password-less sign-in experience.". This seems to imply that you will not be able to use your old password if you ever lost your phone. Do Google still offer backup p…

Same way as you recover a password stored in your password manager. It's pretty much the same thing.

The way I do that is I memorise my password manager master key. How do I do that with a passkey?

Re: Passkeys now support external providers

#158

Post by anderspitman »

My main concern with passkeys is I'm not aware of a way to pre-authorize someone who doesn't yet have an account. For example, with email I can just grant X access to anyone who can prove they have access to Y email address. But passkeys don't have a single public handle like this. This isn't such a big deal with centralized services where everyone is likely to already have an account, but might pose a problem for selfhosted services. Still, I like passkeys and wish there was a way to have my cake and eat it too.

Re: Passkeys now support external providers

#159

Post by withinboredom »

anderspitman wrote: post #145
withinboredom wrote: post #89

Earlier quoted context omitted.

I use 1password + fastmail for exactly this. The integration is better than Apple IMHO.

Do 1password/fastmail have functionality built in for this or do you just manually generate your emails based off a wildcard?

Yes. It’s built-in. https://1password.com/fastmail/

Re: Passkeys now support external providers

#160

Post by toomuchtodo »

spuz wrote: post #157
izacus wrote: post #120

Earlier quoted context omitted.

Same way as you recover a password stored in your password manager. It's pretty much the same thing.

The way I do that is I memorise my password manager master key. How do I do that with a passkey?

Email magic link, recovery codes, web of trust (recovery contacts), or remote government credentials proofing (ID.me, Stripe Identity, etc).
Post reply on HN